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This listing of claims replaces all prior versions, and 
listings of claims in the instant application: 

Listing of Claims; 

1. (Original) A method comprising: 
stalling an attempt to reference an object; and 
determining whether an attempter that originated said 

attempt is authorized to access said object, wherein upon a 
determination that said attempter is authorized to access said 
object, said method further comprising saving at least part of 
said object. 

2. (Original) The method of Claim 1 wherein upon a 
determination that said attempter is authorized to access said 
object, said method further comprising releasing said attempt. 

3. (Original) The method of Claim 2 wherein upon said 
releasing said attempt, said method further comprising 
determining if access is granted using an access control list. 

4. (Original) The method of Claim 2 wherein upon said 
releasing said attempt an ObRef erenceObj ectByHandle ( ) function 
is invoked. 

5. (Original) The method of Claim 1 wherein upon a 
determination that said attempter is not authorized to access 
said object, said method further comprising denying said 
attempt . 

6. (Original) The method of Claim 1 further comprising 
hooking object functionality. 
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7. (Original) The method of Claim 6 wherein said object 
functionality comprises functionality associated with creating, 
modifying, or closing said object. 

8. (Original) The method of Claim 6 wherein said hooking 
object functionality comprises hooking a user mode library. 

9. (Original) The method of Claim 6 wherein said hooking 
object functionality comprises hooking a system call table. 

10. (Original) The method of Claim 6 wherein said 
hooking object functionality comprises hooking an object 
manager . 

11. (Original) The method of Claim 6 wherein said 
hooking object functionality comprises hooking an 
ObRef erenceOb j ectByHandle ( ) function . 

12. (Original) The method of Claim 6 wherein said 
hooking object functionality comprises hooking an 
ObDeref erenceOb j ect ( ) function . 

13. (Original) The method of Claim 6 wherein said 
hooking object functionality comprises hooking object type 
procedures . 
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14. (Original) The method of Claim 1 further comprising 
determining whether said attempt has occurred. 

15. (Original) The method of Claim 1 further comprising 
stalling an attempt to release said object. 

16. (Original) The method of Claim 15 further comprising 
determining whether said object has changed. 
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17. (Original) The method of Claim 16 wherein upon a 
determination that said object has not changed, said method 
further comprising releasing said attempt to release said 
object . 

18. (Original) The method of Claim 16 wherein upon a 
determination that said object has changed, said method further 
comprising determining if said attempter is authorized to 
change said object. 

19. (Original) The method of Claim 18 wherein upon a 
determination that said attempter is authorized to change said 
object, said method further comprising releasing said attempt 
to release said object. 

20. (Original) The method of Claim 18 wherein upon a 
determination that said attempter is not authorized to change 
said object, said method further comprising restoring said 
object . 

21. (Original) The method of Claim 20 wherein said 
restoring comprises replacing at least part of said object with 
a saved at least part of said object. 
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22. (Currently amended) A method The method of Claim 1 
further comprising : 

hooking object functionality; 

stalling an attempt to release aft said object originating 
from aH said attempter; 

determining that said object has been changed by said 
attempter; 

determining that said attempter did not have authority to 
change said object; 
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restoring said object; and 
releasing said attempt. 



23. (Original) The method of Claim 22 wherein said 
attempter is a user of a computer system. 

24. (Original) The method of Claim 22 wherein said 
attempter is a process on a computer system. 

25. (Original) The method of Claim 24 wherein said 
process is a kernel mode process. 



26-34. (Canceled) 



35. (Original) A system comprising: 

a means for stalling an attempt to reference an object; 

a means for determining whether an attempter that 
originated said attempt is authorized to access said object; 
and 

a means for saving at least part of said object upon a 
determination that said attempter is authorized to access said 
object. 
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36. (Currently Amended) A computer-program product 
comprising a tangible computer- readable storage medium 
containing computer program code comprising: 

a behavior blocking and monitoring application for 
stalling an attempt to reference an object; and 

said behavior blocking and monitoring application further 
for determining whether an attempter that originated said 
attempt is authorized to access said object, wherein upon a 
determination that said attempter is authorized to access said 
object, said behavior blocking and monitoring application 
further for saving at least part of said object. 
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37. (Original) A computer system comprising: 

a memory having stored therein a behavior blocking and 

monitoring application; and 

a processor coupled to said memory, wherein execution of 

said behavior blocking and monitoring application generates a 

method comprising: 

stalling an attempt to reference an object; and 
determining whether an attempter that originated said 

attempt is authorized to access said object, wherein upon a 

determination that said attempter is authorized to access said 

object, said method further comprising saving at least part of 

said object . 
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